Re: [dm-crypt] how to get a full disk encryption running on Linux Mint 17

[Jonas Meurer <jonas@freesources.org>]

Am 12.06.2014 13:42, schrieb Andreas:> hello,
>
> having used a Windows-based Truecrypt encryption with
> pre-boot-authentication for some years, I want to do the corresponding
> action under Linux. I am using Linux Mint 17 Cinnamon. The system has
> one harddisk.

Hello Andreas,

first, welcome to the Linux world :)

This list is mainly about dm-crypt kernel implementation, cryptsetup
userspace tool and LUKS. Full disk encryption implementations by Linux
distributions like in Debian, CentOS or Linux Mint are better discussed
on the respective distribution-specific mailinglists or in suitable forums.

I've no experiences with Linux Mint. But as it's a Ubuntu derivate which
itself is a Debian derivate I guess that the disk encryption
implementation is rather similar over there.
At least Debian and Ubuntu Installers do support full disk encrpytion at
installation time. So you don't have to setup it yourself.

Nevertheless I'll give short comments below.

> I got things working so far, using a VirtualBox machine, (so Mint 17 x32
> is used):
> 
>     - 200 MB primary partition ext3 on /dev/sda1 (unencrypted) as /boot
>     - 9,81 GB crypt-luks on /dev/sda2 (as seen from GParted)
> 
> 
> This configuration boots up GRUB, Mint's green/white dots start flashing.
> Then I think a timeout appears - message reads:
> 
>     "Gave up waiting for root device ...
>     ALERT /dev/mapper/ubuntu-root does not exist - dropping to a shell."

Sounds like the disk (/dev/sda2) unlocking mechanism is missing from
your boot process. Therefore LVM doesn't find the logical volumes,
especially not the logical volume 'root' in volume group 'ubuntu'.
Hence, the script that's responsible to mount your root filesystem fails
with the error.

> When I boot up from CD, start "Preferences - Disks"
> [...]
> So, the partions exist and can be unlocked.

So at least the encryption works. My guess is that either the relevant
line in /etc/crypttab is missing, or the cryptsetup binaries and scripts
aren't included in the initramfs.

I suggest you read /usr/share/doc/cryptsetup/README.Debian.gz and
/usr/share/doc/cryptsetup/README.initramfs.gz.

Kind regards,
 jonas